N10-009 Network Operations Practice Question
A network administrator wants to be notified immediately when any interface on a core router goes down. The administrator has already configured SNMP community strings on the router. What additional configuration is necessary to receive these notifications?
⚠ Common exam trap
The N10-009 exam often tests the distinction between SNMP polling (get requests) and SNMP traps (unsolicited notifications), leading candidates to mistakenly think that enabling polling or syslog is sufficient for immediate event-driven alerts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure an SNMP trap receiver on the NMS and set the router to send traps to that receiver.
SNMP traps are unsolicited notifications sent from a managed device (the router) to a Network Management System (NMS) when a specific event occurs, such as an interface going down. Since the administrator already configured SNMP community strings (which provide authentication for SNMP messages), the missing piece is configuring the router to send traps to a specific trap receiver (the NMS) and ensuring the NMS is set up to listen for those traps. Without this trap receiver configuration, the router will not generate or forward the event-driven alerts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable SNMP polling from the NMS at regular intervals.
Why it's wrong here
Enabling SNMP polling from the NMS involves the NMS actively querying the router at predefined intervals to retrieve status information. This "pull" model means the NMS only discovers an interface status change during its next scheduled poll, introducing a delay. For immediate notification of an event like an interface going down, a "push" mechanism like SNMP traps is required, as polling cannot provide instantaneous alerts.
When this WOULD be correct
A network administrator wants to monitor interface status changes on a router by periodically checking its health. The NMS should poll the router at regular intervals to collect performance data and detect changes, rather than relying on unsolicited traps.
- ✓
Configure an SNMP trap receiver on the NMS and set the router to send traps to that receiver.
Why this is correct
Traps are generated by the device when an event occurs. The administrator must specify the trap destination (IP of the NMS) and enable the relevant traps (e.g., linkUp/linkDown). Without this, the router will not send trap messages.
- ✗
Set up syslog to forward log messages to a centralized server.
Why it's wrong here
Setting up syslog forwards log messages to a centralized server for storage and review. While syslog can record interface status changes, it is primarily a logging and auditing mechanism, not a real-time, programmatic notification system designed for immediate NMS action. Unlike SNMP traps, syslog messages often require parsing and do not inherently trigger automated responses within an SNMP-based network management system for critical, instantaneous events.
When this WOULD be correct
A network administrator wants to centralize all router log messages (e.g., interface status changes, errors) to a single server for analysis and alerting. Syslog would be the correct choice for forwarding these log messages.
- ✗
Configure an access control list to allow the NMS to poll the router.
Why it's wrong here
Configuring an access control list (ACL) on the router defines which network traffic is permitted or denied, acting as a security filter. While an ACL might be necessary to allow the Network Management System (NMS) to communicate with the router, including sending SNMP traps, it does not *generate* or *send* any notifications itself. An ACL is a foundational security measure, not an event notification mechanism.
When this WOULD be correct
A network administrator wants to restrict SNMP access to only a specific NMS server. The correct answer would be to configure an ACL on the router that permits SNMP traffic from that NMS IP address, ensuring only authorized polling occurs.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓Configure an SNMP trap receiver on the NMS and set the router to send traps to that receiver.Correct answer▾
Why this is correct
Traps are generated by the device when an event occurs. The administrator must specify the trap destination (IP of the NMS) and enable the relevant traps (e.g., linkUp/linkDown). Without this, the router will not send trap messages.
✗Enable SNMP polling from the NMS at regular intervals.Wrong answer — click to see why▾
Why this is wrong here
SNMP polling requires the NMS to initiate requests, but the question asks for immediate notification when an interface goes down. Polling at regular intervals cannot provide instant notification; traps are needed for unsolicited alerts.
★ When this WOULD be the correct answer
A network administrator wants to monitor interface status changes on a router by periodically checking its health. The NMS should poll the router at regular intervals to collect performance data and detect changes, rather than relying on unsolicited traps.
Why candidates choose this
Candidates may confuse polling with traps, thinking that frequent polling can achieve near-immediate notification, or they may not fully understand that traps are event-driven while polling is request-driven.
✗Set up syslog to forward log messages to a centralized server.Wrong answer — click to see why▾
Why this is wrong here
Syslog forwards log messages, not SNMP traps. The question specifically asks for immediate notification via SNMP, which requires trap configuration, not syslog.
★ When this WOULD be the correct answer
A network administrator wants to centralize all router log messages (e.g., interface status changes, errors) to a single server for analysis and alerting. Syslog would be the correct choice for forwarding these log messages.
Why candidates choose this
Candidates may confuse syslog with SNMP traps, as both can be used for monitoring and alerting, but they operate on different protocols and have different configuration requirements.
✗Configure an access control list to allow the NMS to poll the router.Wrong answer — click to see why▾
Why this is wrong here
An access control list (ACL) controls which NMS can poll the router, but it does not enable the router to send unsolicited SNMP traps. The question asks for immediate notification when an interface goes down, which requires trap generation, not polling.
★ When this WOULD be the correct answer
A network administrator wants to restrict SNMP access to only a specific NMS server. The correct answer would be to configure an ACL on the router that permits SNMP traffic from that NMS IP address, ensuring only authorized polling occurs.
Why candidates choose this
Candidates may confuse access control with notification mechanisms, thinking that allowing the NMS to poll is sufficient for receiving alerts, or they may misremember that ACLs are needed for SNMP trap communication.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Network Documentation and Diagrams
Key term
RX
RX (Receive / Receiver) is the signal path or hardware component that accepts incoming data from a network medium.
Key term
Receiver
A receiver is a hardware device or software component that accepts incoming signals, data, or transmissions from a sender over a communication channel.
About these practice questions
One of 464 original N10-009 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.